Blog
Windows 11 Enterprise multi-session
Learn what Windows 11 Enterprise multi-session is, where it runs, licensing rules, Intune support, FSLogix, and AVD costs.
Table of Contents
- What is Windows 11 Enterprise multi-session?
- Where can Windows 11 Enterprise multi-session run?
- Which licenses grant access to Windows 11 Enterprise multi-session?
- How do you build and size a pooled host pool?
- What profile and identity setup does multi-session require?
- How do you manage Windows 11 Enterprise multi-session with Microsoft Intune?
- How do you control Azure costs with multi-session hosts?
- How Nerdio Manager simplifies multi-session operations at scale
- What to do before you build your first multi-session host pool
- Frequently asked questions about Windows 11 Enterprise multi-session
Windows 11 Enterprise multi-session lets multiple users run their own interactive Windows 11 desktop session on a single virtual machine (VM) in Azure Virtual Desktop. That one capability separates it from every other edition of Windows 11. Until this edition existed, only Windows Server could host concurrent interactive sessions, which meant IT teams had to give users a Server desktop that looked and behaved differently from the Windows their organization actually ran.
This guide is for IT directors and Azure Virtual Desktop platform owners who need a clear picture of what Windows 11 Enterprise multi-session is, how it's licensed, where it runs, and how it's managed through Microsoft Intune. If you're scoping a pooled Azure Virtual Desktop deployment or trying to figure out why certain Intune settings show as "Not applicable" on your session hosts, this covers the foundational facts and current management rules.
Windows 11 Enterprise multi-session is part of Windows Cloud, Microsoft's portfolio that encompasses both Azure Virtual Desktop and Windows 365. Many enterprise organizations run both products side by side. Understanding where multi-session fits before you commit a host pool design to it matters.
What is Windows 11 Enterprise multi-session?
Windows 11 Enterprise multi-session is a special edition of Windows 11 that lets multiple users connect to the same virtual machine simultaneously, each with their own independent desktop session. Previously, only Windows Server could do this.
Each user's session is isolated. What they share is the underlying VM (e.g., its CPU, memory, and storage). That shared-resource model is what makes pooled deployments cost-efficient, and it's also what drives the profile management and Intune rules covered later in this guide.
Users see a standard Windows 11 desktop. There's nothing visually different about their experience.
Note that the OS identifies itself internally the same way Windows Server does. Some older applications and installers interpret this as a server environment and behave unexpectedly. Test any critical applications before deploying them to a production multi-session host pool.
How does multi-session differ from single-session?
Single-session gives each user their own dedicated VM. Multi-session puts multiple users on shared VMs.
In the single-session (personal desktop) model in Azure Virtual Desktop, each user's VM runs whether they're logged in or not. In the multi-session (pooled) model, users are distributed across a shared pool of VMs, and hosts can be shut down and deallocated when demand drops. For workloads where users don't need a dedicated, persistent machine, multi-session pooled is the model that drives per-user costs lower.
Where can Windows 11 Enterprise multi-session run?
Windows 11 Enterprise multi-session is only supported in production as part of Azure Virtual Desktop, running in Azure. It does not run on-premises, on other clouds, or as a general-purpose standalone VM.
You can use the edition outside the Azure Virtual Desktop service for non-production purposes like image customization and testing, but Microsoft does not support it as a server or workstation replacement in those configurations.
Multi-session is currently (as of June 2026) not supported in Azure Virtual Desktop Hybrid, Microsoft's new preview that lets you run cloud-managed virtual desktops on your own on-premises hardware.
Multi-session requires session hosts running in Azure or Azure Local. If you're evaluating AVD Hybrid for some workloads and pooled multi-session for others, those will be separate host pools.
How do you find the right image in the Microsoft Marketplace?
Microsoft publishes official Windows 11 Enterprise multi-session images in the Microsoft Marketplace.
To find the right image, filter the Marketplace by these identifiers:
- Publisher: MicrosoftWindowsDesktop
- Offer: Windows-11
- SKU: any SKU ending in -avd (for example, win11-21h2-avd or win11-22h2-avd)
The -avd suffix on the SKU is what distinguishes the multi-session editions from standard single-session Windows 11 images.
You can deploy these images directly or use them as a base for a custom golden image. For production host pools, Microsoft recommends storing your images in Azure Compute Gallery, which gives you version control and regional replication across multiple Azure regions.
Which licenses grant access to Windows 11 Enterprise multi-session?
Access to Windows 11 Enterprise multi-session is included with eligible per-user Microsoft 365 and Windows licenses. No additional Remote Desktop Services (RDS) Client Access Licenses required.
Per-device licenses are not eligible; the entitlement is per user.
The eligible license categories, from Microsoft's licensing prerequisites, are below.
| License category | Eligible SKUs |
| Microsoft 365 | E3, E5, A3, A5, F3, Business Premium, Student Use Benefit |
| Windows Enterprise | E3, E5 |
| Windows Education | A3, A5 |
| Windows VDA | Per user |
Beyond licensing, Azure Virtual Desktop is consumption-based. You pay for the Azure infrastructure your session hosts use (e.g., compute, storage, and networking).
In a pooled deployment, cost control comes from making sure those resources aren't running when no one needs them.
How do you build and size a pooled host pool?
A pooled host pool is the deployment unit for multi-session. It's the collection of session host VMs that users connect to, managed as a group. How sessions get distributed across those hosts and how large each host VM is end up shaping how the pool actually behaves.
Load balancing: breadth-first vs. depth-first
The choice that matters most for cost is between BreadthFirst and DepthFirst distribution.
BreadthFirst spreads incoming sessions evenly across available hosts, which keeps load balanced and user experience consistent. DepthFirst fills one host to its configured session limit before moving users to the next, so fewer VMs run at the same time.
That makes DepthFirst the natural pairing with auto-scaling for cost-driven deployments. Hosts fill to their session limit before new ones spin up, and empty hosts deallocate once sessions drain off.
BreadthFirst is the better fit when consistent user experience across hosts outweighs minimizing active VM count.
Either way, the Azure Virtual Desktop control plane handles session distribution natively. Azure Load Balancer isn't involved in session routing; it handles web-server-type traffic.
The full set of load balancing algorithms (including Persistent and MultiplePersistent) is in the AVD REST API documentation.
How many vCPUs does a multi-session host need?
Microsoft recommends a minimum of 4 vCPUs per session host, with a supported range of 4 to 24 vCPUs for multi-session workloads. The right size depends on what your users are actually doing.
Light task workers (email, browser, light Office use) can share a host at higher density. Power users running video editing, CAD, or data-heavy applications need more CPU and memory per session and pack fewer per host. Too small and user experience degrades; too large and you're paying for capacity no session is using.
For practical guidance on matching host size to workload, see right-sizing shared host pools.
What profile and identity setup does multi-session require?
Before you can manage multi-session hosts with Intune, two things need to be in place: a profile management solution that lets user profiles follow users across sessions, and a host join configuration that Intune actually supports. Skipping either creates problems that are much harder to fix after the host pool is built.
Why FSLogix is required for pooled hosts
FSLogix is required because pooled hosts are shared. Each time a user logs in, they may land on a different VM. Without profile containerization, their settings, application data, and personalization won't carry over.
FSLogix solves this by packaging the user profile into a virtual disk container that gets mounted to whichever host the user connects to at login. The profile follows the user, not the machine. FSLogix comes pre-installed on every Windows Enterprise multi-session image from Microsoft.
Administrators configure where profile containers are stored (typically Azure Files on an SMB share) and set behavior rules. Azure Files is also the recommended backend for App Attach (attaching application packages to sessions at login) because it works with both Microsoft Entra ID and on-premises Active Directory.
Applications installed in the user context (rather than at the system level) don't persist across sessions on pooled hosts. When a user logs off, those installs disappear. Applications must be deployed at the device level so they're available to every user on the host.
This is the same rule that governs Intune application deployment, covered in the next section.
Which join type supports Intune management?
Session hosts must be either Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra joined means the host connects directly to Entra ID with no dependency on on-premises Active Directory. Hybrid joined means the host is joined to both on-premises Active Directory and Entra ID.
Microsoft Entra Domain Services-joined hosts are not supported for Intune management. This is a hard constraint. If your current design routes session hosts through Entra Domain Services, Intune will not manage them. The join type needs to be decided before the host pool is provisioned.
How do you manage Windows 11 Enterprise multi-session with Microsoft Intune?
Intune management for a Windows 11 Enterprise Azure Virtual Desktop multi-session is generally available for both device-scope and user-scope configuration. That covers Azure Public Cloud and Azure Government Cloud (GCC, GCC High, DoD). The China Sovereign Cloud is not supported.
Prerequisites for Intune management
Six requirements must be met before session hosts enroll in Intune and respond to policy. The table below reflects the current Intune fundamentals requirements.
| Prerequisite | Current requirement |
| Host pool type | Pooled, deployed via Azure Resource Manager |
| Azure Virtual Desktop Agent | Version 1.0.2944.1400 or later |
| Join type | Microsoft Entra hybrid joined (AD Group Policy with device credentials or Configuration Manager co-management) or Microsoft Entra joined (via "Enroll the VM with Intune" in the Azure portal) |
| Enrollment credential type | Device credentials only; user credential enrollment is not supported |
| Licensing | Azure Virtual Desktop license plus Microsoft Intune license |
| Not supported | Microsoft Entra Domain Services-joined session hosts |
For Entra joined hosts, enrollment is enabled through the "Enroll the VM with Intune" option in the host pool configuration. For hybrid joined hosts, a Group Policy setting on the Active Directory side instructs hosts to register with Intune using device credentials.
Device-scope vs. user-scope settings
Device-scope targets the shared VM. User-scope targets the individual user's session on that VM. Both are now supported for multi-session hosts.
Most configuration belongs at the device scope (e.g., OS settings, system-level applications, and security policies). These need to be consistent for everyone who lands on a host.
User-scope handles the exceptions (e.g., settings catalog policies applied per user, user certificates like Trusted, SCEP, PKCS, and PowerShell scripts running in the user context).
Anything you'd customize per person rather than per machine belongs in user scope.
Which Intune features don't work on multi-session hosts?
Security baselines, Windows Update rings, and most remote actions are not supported on pooled multi-session hosts.
For security policy, build your configuration manually using the Settings catalog instead of applying a security baseline.
For update management, use Windows Update for Business through the Settings catalog; the standard "Update rings for Windows" policy does not apply to these hosts. Certificate profiles (Trusted, SCEP, PKCS) and VPN are supported, but only Device Tunnel for VPN, and every other configuration profile template will show as "Not applicable."
The following remote actions are grayed out in Intune for multi-session VMs:
- Windows Autopilot reset
- BitLocker key rotation
- Fresh Start
- Remote lock
- Reset password
- Wipe
Windows Autopilot itself, Commercial OOBE, and the Enrollment Status Page also don't apply to multi-session hosts. Endpoint Privilege Management is limited to personal, single-session hosts.
Application deployment rules
Applications deployed to multi-session hosts must be assigned to devices, not users, and must use the system install context. This is the same requirement FSLogix creates where apps installed in the user context don't persist on pooled hosts, so every app must be installed at the device level to be available to all users.
| Rule | Current requirement |
| Install context | System/device context, not user context |
| Assignment target | Devices, not users |
| Supported assignment intent | Required or Uninstall only; Available intent is not supported |
| Web apps | Not supported |
| Win32 apps with user-context dependencies | Will not install |
| Azure Virtual Desktop RemoteApp | Not currently supported via Intune |
| MSIX app attach | Not currently supported via Intune |
Available intent (where users install apps on demand from a company portal) has no equivalent on a shared host. Every user gets the same app set, deployed by policy.
Compliance and Conditional Access
Intune compliance policies work on multi-session hosts. You can check OS version, valid OS builds, password requirements, and Microsoft Defender states (Antimalware, Firewall, Antivirus, Real-time protection, and Defender risk score).
Both device-based and user-based Conditional Access policies are supported, so you can enforce MFA and block sign-ins from hosts that don't meet your compliance thresholds.
For more detail on automating these policies at scale, see Intune compliance and security policy automation.
Lifecycle behaviors to know before you delete anything
Intune removes Azure Virtual Desktop machines automatically 30 days after deletion, and permanently after 60 days. FSLogix token roaming is not supported; tokens must not be copied or shared across devices.
Cloning an enrolled VM and re-deploying the clone causes enrollment and sync failures. Always build new golden images from scratch rather than cloning an enrolled host.
How do you control Azure costs with multi-session hosts?
Multi-session pooled hosts reduce per-user compute costs, but the savings require active management.
Four levers drive the economics:
- Pooled over personal hosts for workloads that don't need a dedicated machine per user.
- Auto-scaling so VMs deallocate when sessions drain off instead of running idle.
- Right-sizing VMs to match actual workload demand rather than worst-case scenarios.
- Storage tier switching that moves OS disks to a lower-cost tier when VMs are stopped and deallocated during off-hours.
The deallocation point matters. A stopped or powered-off Azure VM still incurs charges. To stop paying for compute, the VM must be fully deallocated, not just powered down. Auto-scaling saves money specifically because it deallocates idle hosts.
How Nerdio Manager simplifies multi-session operations at scale
Native Azure Virtual Desktop tooling works well for a single deployment. When you're managing multiple host pools, image versions across Azure regions, and Intune policies simultaneously (and doing it across both Azure Virtual Desktop and Windows 365) the operational surface gets large fast. The Azure Portal, PowerShell, and Intune are separate consoles with no shared automation.
Nerdio Manager for Enterprise adds an automation and management layer across Azure Virtual Desktop, Windows 365, and Microsoft Intune from a single console that deploys into your own Azure environment.
Cutting image update and host management overhead
Independent testing by Dr. Tritsch IT Consulting found that updating a custom image took 5 minutes 9 seconds and 146 clicks through native Azure Virtual Desktop tooling. When testing Nerdio Manager, they found that the same task took 37 seconds and 13 clicks, a 91% reduction. Reimaging session hosts dropped from 90 clicks to 10. Fewer manual steps mean fewer points where configuration errors can be introduced.
Golden image creation, versioning, and multi-region distribution run through a point-and-click workflow in Nerdio Manager rather than hand-maintained PowerShell scripts.
Auto-scaling and compute cost control
Nerdio Manager's patented auto-scaling deallocates idle hosts on a schedule and switches OS disks between premium and standard storage tiers during off-hours.
Equitable Bank achieved 74% compute savings per month with auto-scaling. Penn State University reduced Azure Virtual Desktop spend by 71% while adding 1,000 or more users.
Extending Intune management for Windows 365 and AVD
Windows 365 Cloud PCs are managed through Intune. Nerdio Manager extends Intune's native capabilities in three ways that directly address the constraints covered above.
Unified Application Management deploys applications to Cloud PCs and session hosts without waiting on Intune's native polling cycle. Nerdio Advisor analyzes Cloud PC usage and surfaces right-sizing recommendations and Flex (formerly Frontline) license conversion opportunities for users whose schedules don't overlap.
Nerdio Manager also creates, backs up, and restores Intune policies. Native Intune cannot back up or restore a deleted policy. Per Dave Fiske at Nerdio: "When we show people that we can do the backup and the restore, they're like, I need this."
For organizations running Azure Virtual Desktop and Windows 365 together, the same policies and automations apply to both from one console.
What to do before you build your first multi-session host pool
Deploying Windows 11 Enterprise multi-session is straightforward. What requires more thought is the sequence of decisions before you build:
- Licensing must cover per-user entitlements.
- Host join type determines whether Intune works at all.
- FSLogix configuration determines whether user profiles and applications behave correctly.
- Host sizing determines whether users have a good experience or a slow one.
Get those right and the ongoing work shifts to operations (e.g., image updates, auto-scaling, and policy management). Those operational gains are where Nerdio Manager pays back, and they matter whether you're deciding between Windows 365 vs. AVD or managing both.
Get a demo to see how Nerdio Manager handles image updates, auto-scaling, and Intune policy management, or try it free.
Frequently asked questions about Windows 11 Enterprise multi-session
Resources
Learn more about Nerdio Manager